Embed Size (px)
Citation preview
Social Networking and Security: The Business Risks of Employee The Business Risks of Employee
Information Sharing
Herbert H. Thompson, Ph.D.Chief Security Strategist, People Security
Gateway Data (noun):Data that seems harmless but, when used Data that seems harmless but, when used properly, can facilitate access to highly sensitive information.
© People Security 2010
CollectiveDirect Use
Conversion of public data to
Amplification
Conversion of public data to private data
Collective Intelligence
Correlating employee behavior to uncover p
access through defined rules
pby bouncing it off a
personsensitive corporate
information
© People Security 2010
Direct Use Gateway Data: Data Direct Use Gateway Data: Data directly convertible into access through rules
© People Security 2010
What is your pet's name?What is your pet's name?Where were you born?Where were you born?What was your first teacher's name?What is the mascot of your What is the mascot of your favorite team?What was your first phone number?What is your favorite restaurant?Who is your favorite singer?Where was your first job?
© People Security 2010
© People Security 2010
Old resumes, LinkedIn, Twitter, Facebook, blogs, friends/family blogs,
Step 1: Reconnaissance , g , y g ,
public online records, etc. Reconnaissance
Click on “Forgot your password?” or Step 2:
Attempt Resets
Click on Forgot your password? or similar links. What do they ask for? What do they reveal?
Step 3: Most people’s online identities have a common root Is it one email address? p
Identify Dependencies
common root. Is it one email address? A mobile phone?
Step 4: Secure the Root
Once you’ve identified core dependencies, do what you can to strengthen the common rootSecure the Root strengthen the common root.
© People Security 2010
Amplification Gateway Data: p ydata that can be amplified when bounced off a person. bounced off a person.
© People Security 2010
xxxx
Credit Card First 4 Digits Total Digits
American E 34xx or 37xx 15Express 34xx or 37xx 15
VISA 4xxx 13 or 16
dMasterCard 51xx-55xx 16
Discover 6011 16
Collective Intelligence Gateway Data: Seemingly innocuous data that can be combined with other data across time a combined with other data across time, a company, or a group to reveal something sensitive. sensitive.
© People Security 2010
Some Potential Direct DisclosuresDisclosures
Information about customers or salesI f ti b t th h lth
Disclosure of legally protected data
Information about the health of a companyNew policies or policy h
Creation of a legally protected “record” in a public place
changesEthics issues internallyHiring or firing
Mergers and acquisitionsPotential strikesTrade secrets disclosed
Company violated a law New features in a product or product changes
© People Security 2010
Company NameCompany Name
© People Security 2010
Telegraphed InformationTelegraphed Information
• Location – services like Loopt append location information
• Job seeking behavior – LinkedIn • Job seeking behavior LinkedIn recommendation requests, resume distribution, etc.
• Linkages/Relationships – new contacts or friends added to social networks
© People Security 2010
© People Security 2010
© People Security 2010
John Smith
© People Security 2010
© People Security 2010
SSummary
• Need to look beyond traditional PII
• Increasing amount • Increasing amount of data equivalency
• Creating awareness Direct Use Amplification Collective
Intelligence
garound Gateway Data can help reduce riskreduce risk
Email: [email protected]
